Learn Dark Web

Cybersecurity

Phishing Awareness Explained

Phishing is one of the most common forms of cybercrime — the way criminals most often get into accounts and steal money online. It works by pretending to be someone you trust — your bank, a delivery company, your boss — and asking you to click, log in or pay. This guide explains how phishing works, the forms it takes, and the habits that stop it.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Note. Phishing is a confidence trick, not a technical hack. The attacker does not break into your account — they persuade you to hand over the keys. That is good news: once you know the patterns, most phishing is easy to spot and easy to ignore.

What phishing is

Phishing is a type of online fraud in which a criminal impersonates a trusted organisation or person to get you to reveal passwords, payment details or other sensitive information, or to install malware. The name comes from fishing: the attacker casts a wide net of messages and waits for someone to bite. Most phishing arrives by email, but the same trick is used in text messages, phone calls, social media messages and even QR codes stuck over genuine ones.

The scale of the problem is large. The FBI Internet Crime Complaint Center (IC3) reports phishing and spoofing among the most frequently reported internet crimes in the United States year after year, and the UK National Cyber Security Centre (NCSC) treats phishing as one of the most common threats facing both individuals and small businesses. You do not need to be careless to be targeted — modern phishing is sent in huge volumes and is often well written, so everyone receives it.

What makes phishing dangerous is not the message itself but what follows. A single click can lead to a fake login page that captures your password, a malicious attachment that installs malware, or a phone call in which a convincing caller talks you into transferring money. The damage is usually discovered later, when money is gone or an account is locked.

How a phishing attack usually works

Most phishing attacks follow the same four steps. First, the attacker chooses a trusted brand to impersonate — a bank, a parcel company, a streaming service, a government department or your employer. Second, they create a message that looks close enough to the real thing: a copied logo, a familiar layout, a plausible sender name. Third, they add urgency: your account will close, your parcel will be returned, a payment failed, a password expires today. Fourth, they give you one action to take: click a link, open an attachment, call a number, or reply with information.

The urgency is the tell. Real organisations rarely demand immediate action by email or text, and they never ask you to log in through a link in an unexpected message. Phishing works because it short-circuits careful thinking — the message is designed to make you act before you check. Slowing down by even thirty seconds defeats most of it.

  • The message arrives unexpectedly and asks you to act now.
  • The sender name looks familiar, but the actual address is wrong or odd.
  • The message asks for a password, a code, or payment details.
  • The link or attachment is the only way offered to solve the problem.

The main types of phishing

Email phishing is the original and still the most common form: bulk messages pretending to be a bank, a retailer or a colleague. Spear phishing is the targeted version — the attacker researches one person or one company and writes a message that uses real names, real projects and real context, which makes it far more convincing. Whaling is spear phishing aimed at senior staff, because one executive credential can open many doors.

Smishing is phishing by text message, often pretending to be a delivery company with a missed-parcel link or a bank warning about a suspicious payment. Vishing is the voice version: a phone call from someone claiming to be your bank, a tech support team or a government office, asking you to confirm details or move money to a safe account. There is no safe account — that is the scam.

Quishing uses QR codes instead of links, often in emails or on printed notices, so the dangerous destination is hidden until you scan. Business email compromise, or BEC, targets finance and admin staff with messages that appear to come from a boss or supplier and request an urgent payment or a change of bank details. Each type is explained in its own guide in this section.

Why phishing works on smart people

Phishing succeeds because it targets human habits, not technical weaknesses. We are trained to respond quickly to messages from authority figures, to be helpful to colleagues, and to worry when something might be wrong with our money. Attackers exploit exactly those reflexes. A message that appears to come from your manager asking for an urgent favour, or from your bank warning of fraud, triggers action before reflection.

Modern phishing has also got better. Where old scams were full of spelling mistakes — a clue many guides still list — today's messages are often clean, well-formatted and personalised, because attackers reuse real templates and sometimes use automation to write them. That is why the strongest defence is not spotting typos but checking through a separate channel: if a message asks you to act, go to the real website or app yourself, or call the organisation on a number you already have.

Fear and helpfulness are the two emotions attackers use most. If a message makes you afraid — your account will be closed, your money is at risk — or makes you want to help quickly — your boss needs a favour, a colleague is stuck — treat that as a reason to pause, not to hurry.

Five habits that stop most phishing

First, never log in through a link in an unexpected message. Open the app or type the website address yourself. Second, check the sender properly: on email, look at the full address, not just the display name; a message from your bank should come from its real domain, not a lookalike with an extra letter or a different ending. Third, treat attachments with suspicion, especially unexpected invoices, delivery notices or documents asking you to enable macros or content.

Fourth, never share a one-time code. Banks and services send codes for you to enter on their own site or app — no genuine member of staff will ever ask you to read one out over the phone or type it into a chat. Fifth, when something feels urgent, verify through a different channel: call the person or organisation on a number from their official website, or walk over and ask. A genuine request survives a five-minute check; a scam does not.

  • Go to the real site or app yourself — never through a message link.
  • Check the full sender address, not just the display name.
  • Never share one-time codes with anyone, by any channel.
  • Verify urgent requests through a separate, trusted channel.
  • Report phishing instead of just deleting it, so others are protected.

What to do if you already clicked or replied

Do not panic, and do not ignore it. If you entered a password, change it immediately from the real website or app — and change it everywhere else you used the same password. Turn on two-factor authentication on the affected account, then check recent activity, connected devices and any changed details such as a recovery email or phone number. If you entered payment details, contact your bank straight away and ask them to watch or block the card.

If you downloaded and opened an attachment, or the page asked you to run something, disconnect from the internet and run a full scan with your security software, then change the passwords of important accounts from a different, clean device. Keep a note of what happened — the sender address, the link, the time — because you will need it when you report it. The full step-by-step triage is in our guide on what to do if you clicked a phishing link.

Reporting matters more than most people realise. In the United States, report phishing to the FBI Internet Crime Complaint Center at ic3.gov. In the United Kingdom, forward phishing emails to report@phishing.gov.uk and report suspicious texts by forwarding them to 7726. Every report helps investigators and helps providers take malicious sites down faster.

Phishing at work and at home

At work, phishing is usually aimed at credentials and payments. Train the whole team on the same rule — verify through a separate channel — and make sure the finance process requires a second check for any change of payment details, however senior the requester appears to be. A short, honest reporting culture matters more than any single training session: if people fear blame for clicking, they hide it, and the damage grows.

At home, the same habits protect children, older relatives and anyone who manages money online. Talk about the common stories: the parcel that never arrived, the refund that needs your card details, the grandchild asking for gift cards, the bank calling about fraud. Agree on a family rule — nobody moves money or shares a code because a message or call told them to — and keep it simple enough to remember under pressure.

Nobody is immune, and that is not a personal failing. Phishing is a numbers game played by professionals, and the organisations being impersonated spend heavily on stopping it. Your job is only to slow down, check separately, and report what you see. Those three habits protect you and the people the attacker will target next.

Sources

Last checked: 14 November 2026.

Frequently asked questions

What is phishing in simple terms?

Phishing is fraud by impersonation: a criminal pretends to be a trusted organisation or person and tricks you into revealing a password, payment details or other sensitive information, usually through an email, text or call that asks you to click a link or act urgently.

Is phishing illegal?

Yes. Phishing is fraud, and it is illegal in most countries. The difficulty is not the law but finding the criminals, who often operate from another country. That is why reporting matters: reports help law enforcement and providers take malicious sites and accounts down.

Can phishing happen by phone or text?

Yes. Phishing by text is called smishing and phishing by voice call is called vishing. The same rules apply: never share a one-time code, never move money because a caller told you to, and verify through a number you already trust.

What is the difference between phishing and spam?

Spam is unwanted bulk email, usually advertising. Phishing is a targeted fraud that impersonates someone you trust to steal information or money. All phishing is unwanted, but not all unwanted email is phishing.

How can I tell if an email is phishing?

Look for an unexpected request, urgency, a sender address that does not match the real organisation, and a link or attachment as the only way to act. The safest check is to ignore the link and go to the real site or app yourself.

What should I do with a phishing email?

Do not click anything in it. In the UK, forward it to report@phishing.gov.uk. In the US, report it to the FBI Internet Crime Complaint Center at ic3.gov. Your email provider also has a report-phishing button — use it.